Global websites shut down over PHP flaws
Critical vulnerabilities have been discovered in the technology powering two-thirds of all websites on the internet. Critical vulnerabilities have been found in PHP technology, which powers millions of websites and online stores.
Consensus
- Two critical vulnerabilities were discovered in the PHP programming language.
- The vulnerabilities were rated 9.2 out of 10 on the CVSS scale, indicating high severity.
- The vulnerabilities allow remote code execution without authentication.
- Emergency security updates for PHP were released on October 21.
- Organizations worldwide temporarily disabled websites as a precaution.
- The vulnerabilities affect approximately 70% of websites using server-side scripting.
- Artificial intelligence tools were used to detect one of the vulnerabilities.
- Owners of websites are advised to update PHP immediately or restrict access if updates are not possible.
- The issue affects systems using WordPress, Drupal, Joomla, and other CMS platforms.
- The vulnerabilities were present in PHP versions 8.2, 8.3, and 8.4, with older versions no longer receiving security updates.
Points of divergence
- The National Coordination Center for Computer Incidents under the FSB of Russia instructed owners of critical information infrastructure to temporarily restrict access or fully disable vulnerable sites if updates cannot be applied promptly. — fontanka
- The vulnerability was detected in 2024, and the fix was delayed due to a lack of specialists and complexity in choosing a solution. — novaya_eu
- The vulnerabilities affect 70% of websites on the internet and are considered among the most serious in PHP's history and possibly in software history. — tg_varlamov_news
- The German Federal Office for Information Security warned that large-scale attacks could begin within hours, and several German municipal and institutional services were temporarily shut down. — tg_dwglavnoe
- Pre-release information about the vulnerabilities led to the creation of exploits before the patch was released, and there were reports of initial attack attempts. — tg_moscowtimes_ru
Coverage (6 sources)
- Sites worldwide are being taken down due to a dangerous error. What is PHP and what does the vulnerability entail — Фонтанка
- Hundreds of millions of sites are at risk of hacking due to vulnerabilities in the PHP programming language. How dangerous is this? And does anything threaten you personally? — Meduza
- Government websites and media outlets worldwide have been taken offline due to critical PHP vulnerabilities. Developers have already released patches. — Новая газета Европа
- Two critical vulnerabilities discovered in PHP programming language, all PHP users recommended to immediately perform updates — Varlamov News
- Cyberattacks and website takedowns expected worldwide: critical vulnerabilities found in PHP programming language — DW Главное
- Critical vulnerabilities found in technology powering two-thirds of all internet sites — The Moscow Times